[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] xen-mapcache: avoid a race on memory map while using MAP_FIXED
- To: Roger Pau Monné <roger.pau@xxxxxxxxxx>
- From: Igor Druzhinin <igor.druzhinin@xxxxxxxxxx>
- Date: Tue, 20 Apr 2021 10:45:03 +0100
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sOVTIxGK8axq+Xxi2TZ+Jjqa+ohX+QH4QqjR4m5CteI=; b=M/uVZKiFZS803Y80OlUsb53Up2LrLb7bA1TGeJZ4uCRHgkGACg8k98+nNisPUwejjNupUbXUfF/lQkjeZVABlr1MqIPv6qnY1MHhElu/D1aFqN6riZejKazK6ojIUZTtoLXpg072lJvoIbZHV0uotxokeLqswbUeAMh2M6zUrSFOKl7LfHterUiNBplbBCPJRR6VIQLXysVvcLsCrnZz1VF+H5aMA45ajRTCLcNx4HqafzK305VQ/RMZDSejKHN+Uns6EW8d/4TG19QwkSar1xISut0diK+SJUoOYe+OYt7HOwgnLM+yiFKW6hr5jdG+Iyd8QtP84RH1hm3GlbjiLg==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mBPIPHfumyHrYVzz5Weilh2/xWfCzv+0vG0TMOTsaDIF+T13LIxR4lAR/oHlwQYnuFpUM+BPN/9YKPAkXUaueYb6FcbLguy+1S5qgj6iXbsS5Qo7qAwZGYMG/d0S2a1GNROxh5o65g4RVb5aec7ld34mbUnz2RHtLOli0+2nJjTA6e6Kuw/lG0POfQB3RHIAssR+K8U11vHOGey71ksh/DVhV/Z3B+KSGsYgY1a0+rSW4Dce6smPIKXEd/ogJRlLc+2PT8JXFgvf5jmwckaUBzRJ9mGzd9PE2tzRf3YtLrXu+aj4OGohWB9wYCibLcFsqCR8nTUwmlyDNGHO4NgiRw==
- Authentication-results: esa3.hc3370-68.iphmx.com; dkim=pass (signature verified) header.i=@citrix.onmicrosoft.com
- Cc: <qemu-devel@xxxxxxxxxx>, <xen-devel@xxxxxxxxxxxxxxxxxxxx>, <sstabellini@xxxxxxxxxx>, <anthony.perard@xxxxxxxxxx>, <paul@xxxxxxx>, <mst@xxxxxxxxxx>, <marcel.apfelbaum@xxxxxxxxx>, <pbonzini@xxxxxxxxxx>, <richard.henderson@xxxxxxxxxx>, <ehabkost@xxxxxxxxxx>
- Delivery-date: Tue, 20 Apr 2021 09:45:13 +0000
- Ironport-hdrordr: A9a23:/AP9hqnLYDnBF1jNt3mNUfd9L2PpDfOFimdD5ilNYBxZY6Wkvu illvgDyFvQgDEeRHkvlbm7Sc+9aFvB6J945pQQN7++XA/g/FClNp1m8JGK+UyfJwTV8OlB2a B8N413D9PtBVZ35PyKkzWQOdAm3dWB7eSUlf7Tpk0dPz1CRql8425Ce2SmO2JsQg0uP/UEPb qaovFKvj+xPUkQB/7LYUUte8jmi5n1mIn9YRgAbiRXlzWmqT+z8rb1H1y5834lIlZy6Iwv+2 TEjAD1j5/L25rXpiP07GPd449bn9Hs0LJ4daixo/IIITbhgBvAXuVccoCCpzw8raWO71sngb D30nQdFvlz8H/YcyWJpwLs0WDbsAoG1nmK8zGlqEqmhea8eDU7E9ZM7LgyTjLpr24b+PB1yu Ziwn+QvZs/N2K4oA3No/zzEyxMumXxi3w4iuIXh2FYSuIlGcdshL1a2ENQHJ0JBj+/zpsmHu loBNzb/59tACOnRkGcmmlqzNalRGl2JA6PRgw5sMqP31Ft7QFE5lpdyN0Um38B8J4nD51Io+ /FPbhynrlSTskQKaJ7HvoIRsG6Y1a9PC7kISafMF7jHKECN2mIr5Oy6rMz6+GlEaZ4tqcaid DMQVlcvW43d1mrDcDLxpFC6RrNBGewTV3Wu71jzok8vKb9SrrtOTCCT15rk9LImYRlPvHm
- Ironport-sdr: NYkUu6Sl9rA7jmFJlf7u8F9v5hWaP7HvKzrM5oBFAIKiTj5Ktub4EoPjwVd07SjlA7/uZBgZ5j iBi+Z7CWRF1RxppBcf3z0U/8LUnt+GuwfeOMLytty1h3+DyMv2GlZfx3tCemKu/KqQPa8Naddi GLBmPh7IKb0lUUB8uIFc9n/UrNTqE77Z4TE9ZJm0YL9hqfHkC9Wt2fGZx2b3OTO8xXn8dd2MCD e7GtrVSwTqS1LPYYxvdcfgK1kq0st0RgicT5NqFLFPi56gy0/TD0FG3HBLaCdQ+eOHc3xsprWB BXU=
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 20/04/2021 09:53, Roger Pau Monné wrote:
On Tue, Apr 20, 2021 at 04:35:02AM +0100, Igor Druzhinin wrote:
When we're replacing the existing mapping there is possibility of a race
on memory map with other threads doing mmap operations - the address being
unmapped/re-mapped could be occupied by another thread in between.
Linux mmap man page recommends keeping the existing mappings in place to
reserve the place and instead utilize the fact that the next mmap operation
with MAP_FIXED flag passed will implicitly destroy the existing mappings
behind the chosen address. This behavior is guaranteed by POSIX / BSD and
therefore is portable.
Note that it wouldn't make the replacement atomic for parallel accesses to
the replaced region - those might still fail with SIGBUS due to
xenforeignmemory_map not being atomic. So we're still not expecting those.
Tested-by: Anthony PERARD <anthony.perard@xxxxxxxxxx>
Signed-off-by: Igor Druzhinin <igor.druzhinin@xxxxxxxxxx>
Should we add a 'Fixes: 759235653de ...' or similar tag here?
I was thinking about it and decided - no. There wasn't a bug here until
QEMU introduced usage of iothreads at the state loading phase.
Originally this process was totally single-threaded. And it's hard to
pinpoint the exact moment when it happened which is also not directly
related to the change here.
Igor
|
